Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later.

But in the context of PKI, a Recovery Agent can also recover private keys.

How are they different? Does a Recovery Agent use a Key Escrow?

share|improve this question
up vote 3 down vote accepted

A "Key Escrow" is used in cases where a third-party needs access to encrypted data, as defined by law (so if you get a court order to decrypt data), while a "Recovery Agent" is someone who is permitted to decrypt another user's data in case of emergency and has a key that can accomplish the decryption.

So in effect, the key escrow is someone who holds the keys for each user, while a recovery agent has a master key.

Edit: "Recovery Agent" is actually defined by Windows too, so you can access EFS-protected files of other users. See: for details.

share|improve this answer
Strictly speaking, the "Key Escrow" isn't just something that's implemented for legal reasons. It could just be the way the company chose to implement their recovery process. Other than that, the distinction between Escrow vs. Agent is pretty accurate here. – Iszi May 17 '13 at 14:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.